elanous 0.2.18 → 0.2.20

package/src/nexus/api/graphs-api.ts

@@ -1,15 +1,31 @@
-import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
+import { debug } from '../../debug/log.js';
 import { defaultGraphsDir, loadGraphTemplatesFrom } from '../../self-implement/graph-templates.js';
 import { loadGraphTemplates } from '../../self-implement/graph-yaml.js';
+import { validateGraphYaml } from './graph-kinds.js';
 import { jsonResponse } from './json-response.js';
 
 /** Declared graph ids only. A user string is never joined onto a filesystem path. */
 const GRAPH_ID = /^[a-z0-9-]+$/;
 
+/**
+ * Sidecar names a graph directory loads specially. `recipes.yaml` next to a graph is what
+ * the graph runner executes (`cmd:` recipes), so an HTTP write to `<mine>/recipes.yaml`
+ * would be a remote command path. These ids are never created, saved or reverted, and
+ * these files are never indexed as graphs.
+ */
+export const RESERVED_GRAPH_IDS: ReadonlySet<string> = new Set(['recipes', 'overlay', 'overlays']);
+
+function reserved(id: string): Response | null {
+  if (!RESERVED_GRAPH_IDS.has(id)) return null;
+  debug.log('nexus.graphs', 'rejected-reserved', { id });
+  return jsonResponse({ error: 'reserved-id', id }, 400);
+}
+
 export interface GraphCatalogEntry {
   id: string;
   source: 'core' | 'mine';
@@ -45,6 +61,7 @@ function readDirYaml(dir: string): string[] {
 function indexByDeclaredId(dir: string): Map<string, { file: string; text: string }> {
   const found = new Map<string, { file: string; text: string }>();
   for (const file of readDirYaml(dir)) {
+    if (RESERVED_GRAPH_IDS.has(file.replace(/\.ya?ml$/, ''))) continue;
     let text: string;
     try { text = readFileSync(join(dir, file), 'utf8'); }
     catch { continue; }
@@ -125,6 +142,21 @@ function validateInTemp(text: string, expectedId: string): { ok: true } | { ok:
   }
 }
 
+/** Same validator as POST /v1/graphs/validate. Invalid → 422; declared graph_id ≠ id → 400. Null = ok. */
+function rejectGraphYaml(text: string, id: string, version?: string): Response | null {
+  const checked = validateGraphYaml('harness', text);
+  if (!checked.ok) {
+    debug.log('nexus.graphs', 'rejected-invalid', { id, ...(version ? { version } : {}), issues: checked.errors });
+    return jsonResponse({ error: 'invalid-graph', errors: checked.errors, ignoredKeys: checked.ignoredKeys }, 422);
+  }
+  if (checked.graphId !== id) {
+    const errors = [{ path: `${id}/graph_id`, message: 'graph_id 가 요청 id 와 다르다' }];
+    debug.log('nexus.graphs', 'rejected-invalid', { id, issues: errors });
+    return jsonResponse({ error: 'graph-id-mismatch', errors }, 400);
+  }
+  return null;
+}
+
 /** Core graphs are read from the same YAML loader as the harness, never rewritten by this API. */
 export function handleGraphsGet(pathname: string, dir = defaultGraphsDir(), deps: GraphsApiDeps = {}): Response {
   const coreDir = deps.coreDir ?? dir;
@@ -168,6 +200,8 @@ export async function handleGraphsPut(pathname: string, req: Request, deps: Grap
   if (!match) return jsonResponse({ error: 'not-found' }, 404);
   const id = resolveId(match[1]!);
   if (!id) return jsonResponse({ error: 'bad_request', reason: 'invalid graph id' }, 400);
+  const reservedId = reserved(id);
+  if (reservedId) return reservedId;
   const coreDir = deps.coreDir ?? defaultGraphsDir();
   const mineDir = deps.mineDir ?? mineGraphsDir();
   const core = coreCatalog(coreDir);
@@ -178,12 +212,146 @@ export async function handleGraphsPut(pathname: string, req: Request, deps: Grap
   let body: { yaml?: unknown };
   try { body = await req.json() as { yaml?: unknown }; }
   catch { return jsonResponse({ error: 'bad_request', reason: 'json body required' }, 400); }
-  if (typeof body.yaml !== 'string') return jsonResponse({ error: 'bad_request', reason: 'yaml string required' }, 400);
-  const checked = validateInTemp(body.yaml, id);
-  if (!checked.ok) return jsonResponse({ error: 'invalid-graph', errors: checked.errors }, 400);
+  if (typeof body?.yaml !== 'string') return jsonResponse({ error: 'bad_request', reason: 'yaml string required' }, 400);
+  const rejected = rejectGraphYaml(body.yaml, id);
+  if (rejected) return rejected;
   const existing = indexByDeclaredId(mineDir).get(id)!;
-  writeFileSync(join(mineDir, existing.file), body.yaml);
-  return jsonResponse({ id, source: 'mine', editable: true, saved: true });
+  // Writes go only to <mine>/<id>.yaml; a hand-placed file under another name is not edited over HTTP.
+  if (existing.file !== `${id}.yaml`) return jsonResponse({ error: 'file-name-mismatch', id, file: existing.file }, 409);
+  const { version, previous } = writeWithVersion(mineDir, id, existing, body.yaml);
+  debug.log('nexus.graphs', 'saved', { id, version, previous });
+  return jsonResponse({ id, source: 'mine', editable: true, saved: true, version, previous });
+}
+
+const VERSION_ID = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z(?:-\d{4})?$/;
+export const GRAPH_VERSION_CAP = 20;
+
+function versionsDir(mineDir: string, id: string): string {
+  return join(mineDir, '.versions', id);
+}
+
+/** Version ids are ISO timestamps (`:`/`.` → `-`), so name order is save order. */
+export function listGraphVersions(mineDir: string, id: string): Array<{ version: string; savedAt: string; bytes: number }> {
+  const dir = versionsDir(mineDir, id);
+  // Only `.yaml` is ever written, read and reverted — a stray `.yml` is not a version.
+  return readDirYaml(dir)
+    .filter((file) => file.endsWith('.yaml'))
+    .map((file) => file.replace(/\.yaml$/, ''))
+    .filter((version) => VERSION_ID.test(version))
+    .sort()
+    .map((version) => {
+      const iso = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z/.exec(version);
+      let bytes = 0;
+      try { bytes = statSync(join(dir, `${version}.yaml`)).size; } catch { /* listed above; raced away */ }
+      return { version, savedAt: iso ? `${iso[1]}T${iso[2]}:${iso[3]}:${iso[4]}.${iso[5]}Z` : version, bytes };
+    });
+}
+
+function recordVersion(mineDir: string, id: string, text: string): string {
+  const dir = versionsDir(mineDir, id);
+  mkdirSync(dir, { recursive: true });
+  const base = new Date().toISOString().replace(/[:.]/g, '-');
+  let version = base;
+  for (let n = 1; existsSync(join(dir, `${version}.yaml`)); n += 1) version = `${base}-${String(n).padStart(4, '0')}`;
+  writeFileSync(join(dir, `${version}.yaml`), text);
+  const all = listGraphVersions(mineDir, id);
+  for (const old of all.slice(0, Math.max(0, all.length - GRAPH_VERSION_CAP))) {
+    rmSync(join(dir, `${old.version}.yaml`), { force: true });
+  }
+  return version;
+}
+
+/**
+ * Every saved state is a version. A graph with no history yet (e.g. a fresh clone)
+ * first records its current bytes, so `previous` always points at restorable bytes.
+ */
+function writeWithVersion(mineDir: string, id: string, existing: { file: string; text: string }, text: string): { version: string; previous: string } {
+  const history = listGraphVersions(mineDir, id);
+  const previous = history.at(-1)?.version ?? recordVersion(mineDir, id, existing.text);
+  // Version first, then an atomic replace of the current file: a crash in between leaves
+  // the old current bytes intact (they are `previous`), never bytes that no version holds.
+  const version = recordVersion(mineDir, id, text);
+  const target = join(mineDir, `${id}.yaml`);
+  const temp = join(mineDir, `.${id}.yaml.${process.pid}.tmp`);
+  writeFileSync(temp, text);
+  renameSync(temp, target);
+  return { version, previous };
+}
+
+function mineOwnership(id: string, deps: GraphsApiDeps): { mineDir: string; existing: { file: string; text: string } } | Response {
+  const reservedId = reserved(id);
+  if (reservedId) return reservedId;
+  const coreDir = deps.coreDir ?? defaultGraphsDir();
+  const mineDir = deps.mineDir ?? mineGraphsDir();
+  const existing = indexByDeclaredId(mineDir).get(id);
+  if (!existing) {
+    const core = coreCatalog(coreDir);
+    if (core.ok && indexByDeclaredId(coreDir).has(id)) return jsonResponse({ error: 'core-read-only', id }, 403);
+    return jsonResponse({ error: 'not-found', id }, 404);
+  }
+  return { mineDir, existing };
+}
+
+/** GET /v1/graphs/<id>/versions — only «mine» graphs have history. */
+export function handleGraphVersionsGet(pathname: string, deps: GraphsApiDeps = {}): Response {
+  const match = /^\/v1\/graphs\/([^/]+)\/versions$/.exec(pathname);
+  if (!match) return jsonResponse({ error: 'not-found' }, 404);
+  const id = resolveId(match[1]!);
+  if (!id) return jsonResponse({ error: 'bad_request', reason: 'invalid graph id' }, 400);
+  const owned = mineOwnership(id, deps);
+  if (owned instanceof Response) return owned;
+  return jsonResponse({ id, versions: listGraphVersions(owned.mineDir, id) });
+}
+
+/** POST /v1/graphs/<id>/revert {version} — restores that version; the restore is itself a new version. */
+export async function handleGraphsRevert(pathname: string, req: Request, deps: GraphsApiDeps = {}): Promise<Response> {
+  const match = /^\/v1\/graphs\/([^/]+)\/revert$/.exec(pathname);
+  if (!match) return jsonResponse({ error: 'not-found' }, 404);
+  const id = resolveId(match[1]!);
+  if (!id) return jsonResponse({ error: 'bad_request', reason: 'invalid graph id' }, 400);
+  const owned = mineOwnership(id, deps);
+  if (owned instanceof Response) return owned;
+  if (owned.existing.file !== `${id}.yaml`) return jsonResponse({ error: 'file-name-mismatch', id, file: owned.existing.file }, 409);
+  let body: { version?: unknown };
+  try { body = await req.json() as { version?: unknown }; }
+  catch { return jsonResponse({ error: 'bad_request', reason: 'json body required' }, 400); }
+  if (typeof body?.version !== 'string' || !VERSION_ID.test(body.version)) {
+    return jsonResponse({ error: 'bad_request', reason: 'version string required' }, 400);
+  }
+  const target = body.version;
+  // Only a listed version id is ever joined onto a path.
+  if (!listGraphVersions(owned.mineDir, id).some((entry) => entry.version === target)) {
+    return jsonResponse({ error: 'version-not-found', id, version: target }, 404);
+  }
+  const text = readFileSync(join(versionsDir(owned.mineDir, id), `${target}.yaml`), 'utf8');
+  const rejected = rejectGraphYaml(text, id, target);
+  if (rejected) return rejected;
+  const { version, previous } = writeWithVersion(owned.mineDir, id, owned.existing, text);
+  debug.log('nexus.graphs', 'reverted', { id, version, previous, restoredFrom: target });
+  return jsonResponse({ id, source: 'mine', editable: true, reverted: true, version, previous, restoredFrom: target });
+}
+
+/** POST /v1/graphs {id, yaml} — a brand-new «mine» graph (blank canvas → save). Records version v1. */
+export async function handleGraphsCreate(req: Request, deps: GraphsApiDeps = {}): Promise<Response> {
+  let body: { id?: unknown; yaml?: unknown };
+  try { body = await req.json() as { id?: unknown; yaml?: unknown }; }
+  catch { return jsonResponse({ error: 'bad_request', reason: 'json body required' }, 400); }
+  const id = typeof body?.id === 'string' ? resolveId(body.id) : null;
+  if (!id) return jsonResponse({ error: 'bad_request', reason: 'id must match [a-z0-9-]' }, 400);
+  const reservedId = reserved(id);
+  if (reservedId) return reservedId;
+  if (typeof body.yaml !== 'string') return jsonResponse({ error: 'bad_request', reason: 'yaml string required' }, 400);
+  const coreDir = deps.coreDir ?? defaultGraphsDir();
+  const mineDir = deps.mineDir ?? mineGraphsDir();
+  if (indexByDeclaredId(coreDir).has(id)) return jsonResponse({ error: 'core-read-only', id }, 403);
+  if (indexByDeclaredId(mineDir).has(id) || existsSync(join(mineDir, `${id}.yaml`))) return jsonResponse({ error: 'exists', id }, 409);
+  const rejected = rejectGraphYaml(body.yaml, id);
+  if (rejected) return rejected;
+  mkdirSync(mineDir, { recursive: true });
+  writeFileSync(join(mineDir, `${id}.yaml`), body.yaml, { flag: 'wx' });
+  const version = recordVersion(mineDir, id, body.yaml);
+  debug.log('nexus.graphs', 'saved', { id, version, created: true });
+  return jsonResponse({ id, source: 'mine', editable: true, saved: true, version, previous: null }, 201);
 }
 
 /** Copy core bytes into «my graphs», changing only the declared graph_id. */
@@ -198,6 +366,8 @@ export async function handleGraphsClone(pathname: string, req: Request, deps: Gr
   if (typeof body.newId !== 'string' || !GRAPH_ID.test(body.newId) || body.newId === id) {
     return jsonResponse({ error: 'bad_request', reason: 'newId must match [a-z0-9-]' }, 400);
   }
+  const reservedId = reserved(body.newId);
+  if (reservedId) return reservedId;
   const coreDir = deps.coreDir ?? defaultGraphsDir();
   const mineDir = deps.mineDir ?? mineGraphsDir();
   const source = indexByDeclaredId(coreDir).get(id) ?? indexByDeclaredId(mineDir).get(id);
@@ -215,7 +385,9 @@ export async function handleGraphsClone(pathname: string, req: Request, deps: Gr
 }
 
 export async function handleGraphsMutation(pathname: string, req: Request, deps: GraphsApiDeps = {}): Promise<Response | null> {
+  if (req.method === 'POST' && pathname === '/v1/graphs') return handleGraphsCreate(req, deps);
   if (req.method === 'PUT' && /^\/v1\/graphs\/[^/]+\/yaml$/.test(pathname)) return handleGraphsPut(pathname, req, deps);
   if (req.method === 'POST' && /^\/v1\/graphs\/[^/]+\/clone$/.test(pathname)) return handleGraphsClone(pathname, req, deps);
+  if (req.method === 'POST' && /^\/v1\/graphs\/[^/]+\/revert$/.test(pathname)) return handleGraphsRevert(pathname, req, deps);
   return null;
 }

package/src/nexus/api/http-server.ts

@@ -24,6 +24,7 @@ import { createProject, listProjects } from '../../project/project-store.js';
 import { handleOutputsGet, type OutputsDeps } from './outputs-route.js';
 import { buildGridData, type GridDeps } from './grid.js';
 import { DECISIONS_PATH, handleDecisions, type DecisionsRouteDeps } from './decisions-route.js';
+import { OPS_BOARD_PATH, handleOpsBoard, type OpsBoardDeps } from './ops-board-route.js';
 import { CARD_FOLLOWUP_PATH, createCardFollowupJobs, type CardFollowupJobs } from './card-followup-route.js';
 import { SKILL_EXEC_PATH, createSkillExecJobs, type SkillExecJobs } from './skill-exec-route.js';
 import { compareTokenConstTime } from '../../acp/transport/auth.js';
@@ -166,7 +167,8 @@ import { handleHarnessAskPost, handleHarnessAskStatusGet, handleHarnessRunEvents
 import { handleLoopEdgesGet } from './loop-edges.js';
 import { handleFabricPlans, type FabricPlansRouteOpts } from './fabric-plans.js';
 import { dispatchPersonaRoute } from './personas.js';
-import { handleMe } from './operator.js';
+import { handleMe, operatorSignal } from './operator.js';
+import { handleGraphRunRoute } from '../../graph-runner/graph-run-api.js';
 import { handleOpsApi } from './ops-api.js';
 import { handleRoleJudge } from './role-judge.js';
 import { handleAudioStt } from './audio-stt.js';
@@ -363,7 +365,7 @@ import {
 } from './workflows.js';
 import { handleTriggersSnapshot } from './triggers.js';
 import { handleWorkflowTemplatesList } from './workflow-templates.js';
-import { handleGraphsGet, handleGraphsMutation } from './graphs-api.js';
+import { handleGraphVersionsGet, handleGraphsGet, handleGraphsMutation } from './graphs-api.js';
 import { handleGraphKindsGet, handleGraphsValidatePost } from './graph-kinds.js';
 import { syncInstalledPluginNodes } from '../../graph-kinds/installed-plugin-nodes.js';
 import { elanousStateRoot } from '../../autopilot/state-paths.js';
@@ -413,6 +415,8 @@ import { handleSelfEvent } from './self-event.js';
 /** 매매 «실행»은 애드온이다(대표 09-20 결정 ③ · 별도 상용 저장소 · release/trading-export.yaml) — 공개 코어엔 없다.
  *  있으면 그 경로를 켜고, 없으면 501. 경로를 변수로 둬 공개본 타입 검사가 «모듈 없음»으로 막히지 않게 한다. */
 const TRADE_PROPOSAL_MODULE: string = './trade-proposal.js';
+/** PITCH-ROOM — 투자자 피치 방(덱·티저)은 비공개다(release/public-export.yaml 이 pitch-api 를 뺀다). 공개본엔 모듈이 없어 404. */
+const PITCH_MODULE: string = './pitch-api.js';
 import {
   handleShowroomLayoutDelete,
   handleShowroomLayoutGet,
@@ -482,6 +486,7 @@ export interface NexusHttpServerOpts {
   /** Read-only grid measurement seam; omitted in production for live HQ and Pod pool reads. */
   grid?: GridDeps;
   decisions?: Pick<DecisionsRouteDeps, 'ledger'>;
+  opsBoard?: Pick<OpsBoardDeps, 'openStore'>;
   cardFollowup?: CardFollowupJobs;
   skillExec?: SkillExecJobs;
   execRequests?: ExecRequestRunner;
@@ -926,6 +931,30 @@ export async function routeRequest(
   if (pathname === '/v1/ops' || pathname.startsWith('/v1/ops/')) {
     return handleOpsApi(req, opts.metaApi);
   }
+  // PITCH-ROOM — same operatorSignal gate, inside the (private-only) pitch module.
+  if (pathname.startsWith('/v1/pitch/')) {
+    let pitch: { handlePitchApi(req: Request, metaApi: typeof opts.metaApi): Response };
+    try {
+      pitch = await import(PITCH_MODULE) as typeof pitch;
+    } catch {
+      return jsonResponse({ error: 'not-found' }, 404);
+    }
+    return pitch.handlePitchApi(req, opts.metaApi);
+  }
+  // CGE-RUN — 편집기 «실행»은 운영자 전용이다: 사용자 그래프가 셸 노드를 부를 수 있으므로 같은 출처 무토큰 통과는 받지 않는다
+  // (운영자 프록시 헤더 · owner bearer 일치 · owner 가 발급한 짧은 임시 토큰만 — 명시 토큰은 언제나 필요).
+  if (/^\/v1\/graphs\/[^/]+\/(?:run|runs\/[^/]+)$/.test(pathname)) {
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
+    const signal = operatorSignal(req, opts.metaApi);
+    const credential = bearerCredential(req, opts.metaApi);
+    if (!signal.operator || (signal.operatorSource !== 'op-proxy' && credential !== 'bearer-match' && credential !== 'temp-token')) {
+      debug.log('graphs.run', 'refused', { path: pathname, source: signal.operatorSource });
+      return jsonResponse({ error: 'forbidden' }, 403);
+    }
+    const routed = handleGraphRunRoute(method, pathname);
+    if (routed) return routed;
+    return jsonResponse({ error: 'method-not-allowed' }, 405);
+  }
 
   // Default-deny for every `/v1/` path that is not on PUBLIC_ROUTES.
   // Reuses checkAuth (same-origin exemption + constant-time bearer).
@@ -1299,12 +1328,11 @@ export async function routeRequest(
     return handleDevices(req, opts.devices);
   }
 
+  // Same owner auth as the neighbouring GETs (short-lived owner tokens · same-origin PWA); #23932 compared the admin
+  // bearer only, so a PWA on a short-lived token got 401 and the loop map stayed empty.
   if (pathname === '/v1/loops/edges' && method === 'GET') {
-    if (!opts.metaApi?.bearerToken) return jsonResponse({ error: 'unauthorized' }, 401);
-    const offered = req.headers.get('authorization');
-    if (!offered?.startsWith('Bearer ') || !compareTokenConstTime(offered.slice('Bearer '.length).trim(), opts.metaApi.bearerToken)) {
-      return jsonResponse({ error: 'unauthorized' }, 401);
-    }
+    if (!opts.metaApi) return jsonResponse({ error: 'meta-api-runtime-not-wired' }, 503);
+    if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
     return handleLoopEdgesGet(req);
   }
 
@@ -1381,6 +1409,21 @@ export async function routeRequest(
     return (opts.cardFollowup ?? defaultCardFollowupJobs()).get(pathname.slice(CARD_FOLLOWUP_PATH.length + 1));
   }
 
+  if (pathname === OPS_BOARD_PATH && (method === 'GET' || method === 'POST')) {
+    const peerAddress = (server as BunServerLike & { requestIP?: (request: Request) => { address: string } | null }).requestIP?.(req)?.address;
+    const host = req.headers.get('host') ?? new URL(req.url).host;
+    const tailnetPeer = peerAddress !== undefined && (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(peerAddress)
+      || /^fd7a:115c:a1e0:/i.test(peerAddress));
+    const localPeer = peerAddress === '127.0.0.1' || peerAddress === '::1';
+    const tailnetHost = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3}\.\d{1,3}(?::\d+)?$/.test(host)
+      || /^\[fd7a:115c:a1e0:[0-9a-f:]+\](?::\d+)?$/i.test(host) || /^[a-z0-9-]+(?:\.[a-z0-9-]+)*\.ts\.net(?::\d+)?$/i.test(host);
+    const localHost = /^(?:localhost|127\.0\.0\.1)(?::\d+)?$/.test(host) || /^\[::1\](?::\d+)?$/.test(host);
+    if ((!tailnetPeer && !localPeer) || (!tailnetHost && !localHost)) return jsonResponse({ error: 'forbidden' }, 403);
+    return handleOpsBoard(req, {
+      authorize: request => !!opts.metaApi && opts.metaApi.noAuth !== true && checkAuth(request, opts.metaApi),
+      ...opts.opsBoard,
+    });
+  }
   if (method === 'GET' && pathname === DECISIONS_PATH) {
     return handleDecisions(req, {
       authorize: request => !!opts.metaApi && checkAuth(request, opts.metaApi),
@@ -1460,7 +1503,7 @@ export async function routeRequest(
       if (!opts.metaApi) return jsonResponse({ error: 'unauthorized' }, 401);
       return handlePluginsRemove(req, pluginRemove[1]!, opts.metaApi, opts.pluginStateRoot);
     }
-    if ((method === 'PUT' || method === 'POST') && pathname.startsWith('/v1/graphs/')) {
+    if ((method === 'PUT' || method === 'POST') && (pathname.startsWith('/v1/graphs/') || pathname === '/v1/graphs')) {
       if (!opts.metaApi) return jsonResponse({ error: 'meta-api-not-wired' }, 503);
       if (!checkAuth(req, opts.metaApi)) return jsonResponse({ error: 'unauthorized' }, 401);
       const mutated = await handleGraphsMutation(pathname, req);
@@ -2774,6 +2817,9 @@ export async function routeRequest(
   if (method === 'GET' && (pathname === '/v1/graphs' || /^\/v1\/graphs\/[^/]+$/.test(pathname) || /^\/v1\/graphs\/[^/]+\/yaml$/.test(pathname))) {
     return handleGraphsGet(pathname);
   }
+  if (method === 'GET' && /^\/v1\/graphs\/[^/]+\/versions$/.test(pathname)) {
+    return handleGraphVersionsGet(pathname);
+  }
   // Archon-port T2.3 (2026-05-08) — workflow GET surface.
   // (POST /validate · POST /:name/run · PUT/DELETE /:name landed
   // inside the mutation block above.)